CVE-2022-21648

Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.

• CWE-79
• CWE-79

• https://github.com/nette/latte/commit/9e1b4f7d70f7a9c3fa6753ffa7d7e450a3d4abb0Patch, Third Party Advisory
• https://github.com/nette/latte/security/advisories/GHSA-36m2-8rhx-f36jThird Party Advisory
• https://github.com/nette/latte/commit/9e1b4f7d70f7a9c3fa6753ffa7d7e450a3d4abb0Patch, Third Party Advisory
• https://github.com/nette/latte/security/advisories/GHSA-36m2-8rhx-f36jThird Party Advisory

Published

Jan 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-21641Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2022-21642Discourse is an open source platform for community discussio…4.3
• CVE-2022-21643USOC is an open source CMS with a focus on simplicity. In af…9.8
• CVE-2022-21644USOC is an open source CMS with a focus on simplicity. In af…7.2
• CVE-2022-21646SpiceDB is a database system for managing security-critical …8.1
• CVE-2022-21647CodeIgniter is an open source PHP full-stack web framework. …9.8
• CVE-2022-21649Convos is an open source multi-user chat that runs in a web …5.4
• CVE-2022-2165Insufficient data validation in URL formatting in Google Chr…4.3
• CVE-2022-21650Convos is an open source multi-user chat that runs in a web …5.4
• CVE-2022-21651Shopware is an open source e-commerce software platform. An …6.1
• CVE-2022-21652Shopware is an open source e-commerce software platform. In …8.1
• CVE-2022-21653Jawn is an open source JSON parser. Extenders of the `org.ty…7.5